by Kastro
Paper/Archive/CVE-2026-25874

CVE-2026-25874

Hugging Face LeRobot — LeRobot Unsafe Deserialization Remote Code Execution via gRPC

EPSS 16%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 96.8.968 × 2019.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize data received over unauthenticated gRPC channels without TLS in the policy server and robot client components. An unauthenticated network-reachable attacker can achieve arbitrary code execution on the server or client by sending a crafted pickle payload through the SendPolicyInstructions, SendObservations, or GetActions gRPC calls.

Affected

ProductAffectedFixed inSource
LeRobot≤ 0.5.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitchocapikk.com/posts/2026/lerobot-pickle-rcerefgithub.com/huggingface/lerobot/issues/3047refgithub.com/huggingface/lerobot/pull/3048refgithub.com/huggingface/lerobot/issues/3134writeupvulncheck.com/advisories/lerobot-unsafe-deserialization-remote-code-execution-via-grpc